@camstack/addon-post-analysis 1.2.130 → 1.2.132

package/dist/pipeline-analytics/index.js

@@ -2,7 +2,7 @@ Object.defineProperties(exports, {
 	__esModule: { value: true },
 	[Symbol.toStringTag]: { value: "Module" }
 });
-const require_dist = require("../dist-CDHL-0gR.js");
+const require_dist = require("../dist-BB-Ol201.js");
 let node_fs = require("node:fs");
 node_fs = require_dist.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -5413,6 +5413,12 @@ function buildAlarmButtons(input) {
 	}];
 }
 //#endregion
+//#region src/notification-center/cap-caller.ts
+function requireCapCaller(method, caller) {
+	if (caller === void 0 || typeof caller.userId !== "string" || caller.userId.length === 0) throw new Error(`notification-rules.${method} declares caller: 'required' and this call carried no caller identity — an addon-to-addon cap call has no authenticated user`);
+	return caller;
+}
+//#endregion
 //#region src/notification-center/audio-rule-matcher.ts
 /**
 * AudioWatcher — the Notification Center's matcher for audio rules
@@ -15359,33 +15365,95 @@ function remainingSummaryCandidates(kept, taken, rank) {
 /**
 * The media a tile is drawn from, best first.
 *
-* First-level group crop only (`groupCrop`), then the group's native-frame
-* pointer, then a member's clean full frame. Member `thumbnail` / plate /
-* face crops stay off this ladder: a successful plate read overwrites the
-* vehicle first-level crop under the same `thumbnail` kind, and a digest
-* tile of a targa is the wrong picture. Boxed frames stay absent: a drawn
-* rectangle is a permanent lie in a digest tile. Duplicate driveways from
-* tracker ID churn are collapsed by `frameDedupeKey`, not by hiding the
-* full-frame fallback.
+* A digest tile is a SUBJECT, so the crops come first: the group's first-level
+* crop (`groupCrop`), the group's native-frame pointer, then the TRACK's own
+* subject crop (`thumbnail`, then its `thumbnailSmall` downscale), and only
+* then the clean whole scene (`keyFrame` → `keyFrameSmall` → `fullFrame`).
+*
+* ⚠ The whole-scene rungs are a FALLBACK and stay on the ladder. Measured on
+* 60 real tracks (615/617, 24 h): 52 carry a crop, 43 carry a scene rung, and
+* 2 carry a scene rung and NO crop — dropping the fallback would delete those
+* two tiles for nothing. A track with neither is dropped, never drawn as an
+* empty cell (see `NcSummaryProducer.loadTiles`).
+*
+* ## Why `thumbnail` is back (2026-08-27)
+*
+* It was removed on 2026-08-24 (160200681) because a successful plate read
+* overwrites the vehicle first-level crop under the same `thumbnail` kind.
+* **That collision belongs to the GROUP entity**: the sealer is what writes
+* `ownerKind: 'group', kind: 'thumbnail'` (`group/group-sealer.ts`), and the
+* group process is OFF (`GROUPS_PROCESS_ENABLED`, `group/group-enabled.ts`).
+* On a TRACK, plates live under `ownerKind: 'plate'` / `kind: 'plateCrop'` and
+* never touch `thumbnail`. The same commit turned the group process off, so
+* `groupCrop` and `nativeFrame` became unreachable and every digest tile fell
+* through to `keyFrame` — a whole frame — for three days.
+* `scripts/check-summary-ladder-reachable.ts` is the guard that refuses that
+* shape now.
+*
+* Boxed frames stay absent: a drawn rectangle is a permanent lie in a digest
+* tile. Plate and face crops stay absent: a digest tile of a targa is the
+* wrong picture. Duplicate driveways from tracker ID churn are collapsed by
+* `frameDedupeKey`, not by hiding the whole-scene fallback.
 */
 var SUMMARY_MEDIA_LADDER = [
 	"groupCrop",
 	"nativeFrame",
+	"thumbnail",
+	"thumbnailSmall",
 	"keyFrame",
 	"keyFrameSmall",
 	"fullFrame"
 ];
 /**
+* The floor below which a `thumbnail` row is NOT a subject crop.
+*
+* `copyFaceCropIfTrackHasNoThumbnail` (`pipeline-analytics/copy-face-crop-preview.ts`)
+* copies the persisted face crop onto a track that has no preview of its own,
+* and it stores it under `kind: 'thumbnail'` — so an ArcFace **112×112**
+* alignment template lands on the ladder wearing the same kind as a real
+* subject crop. Measured: 3 of 52 track thumbnails (5.8%) are 3–10 KB
+* templates. Delivering one is a face in a digest of passages.
+*
+* 20 KiB is chosen as the smallest number that is unambiguous in BOTH
+* directions: it is 2× the largest template observed (10 KB) and above the
+* theoretical ceiling of a 112×112 JPEG at any quality, while a native-
+* resolution subject crop measures in the hundreds of KB. The second reason
+* the number is safe: a genuine crop small enough to fall under it is a
+* subject a few dozen pixels across, which is a smear in a mosaic cell — the
+* whole-scene rung below is the better picture either way.
+*
+* The check costs NOTHING: `MediaFileInfo.sizeBytes` is already on the index
+* row, so no blob is fetched and nothing is decoded to apply it.
+*/
+var SUMMARY_THUMBNAIL_MIN_BYTES = 20480;
+/** The rungs {@link SUMMARY_THUMBNAIL_MIN_BYTES} is applied to. */
+var SUMMARY_SIZE_GATED_RUNGS = new Set(["thumbnail"]);
+/**
+* Is this row a picture, or a template wearing a picture's kind?
+*
+* Only a size the index REPORTED can demote a row. A `null` size is unknown,
+* and demoting on unknown would silently delete every group-owned pointer.
+*/
+function rowClearsSizeFloor(row, rung) {
+	if (!SUMMARY_SIZE_GATED_RUNGS.has(rung)) return true;
+	if (typeof row.sizeBytes !== "number") return true;
+	return row.sizeBytes >= SUMMARY_THUMBNAIL_MIN_BYTES;
+}
+/**
 * Pick ONE media row for a track — the cheap question first (index rows only),
 * so exactly one blob is ever read.
 *
 * Within a rung the row CLOSEST to the track's peak is chosen; a member may
 * carry more than one full-frame still, so "the first one" would systematically
 * pick the moment the subject entered rather than the moment it was best seen.
+*
+* A `thumbnail` under {@link SUMMARY_THUMBNAIL_MIN_BYTES} DESCENDS to the next
+* rung rather than being drawn — see that constant for the face template it
+* exists to catch.
 */
 function pickSummaryMedia(rows, aroundMs) {
 	for (const rung of SUMMARY_MEDIA_LADDER) {
-		const matches = rows.filter((row) => row.kind === rung);
+		const matches = rows.filter((row) => row.kind === rung && rowClearsSizeFloor(row, rung));
 		if (matches.length === 0) continue;
 		return matches.reduce((best, row) => Math.abs(row.timestamp - aroundMs) < Math.abs(best.timestamp - aroundMs) ? row : best);
 	}
@@ -15697,12 +15765,13 @@ var NcSummaryProducer = class {
 					droppedStationary: filtered.droppedStationary
 				};
 			}
-			const loaded = await this.loadTiles({
+			const tileLoad = await this.loadTiles({
 				rule,
 				preferred: selection.tiles,
 				refill: remainingSummaryCandidates(filtered.kept, selection.tiles, rule.rank),
 				maxTiles: rule.maxTiles
 			});
+			const loaded = tileLoad.tiles;
 			const detections = countDetections({ tracks: selection.tiles.map((t) => ({
 				firstSeen: t.firstSeen,
 				lastSeen: t.lastSeen,
@@ -15760,7 +15829,8 @@ var NcSummaryProducer = class {
 				tiles: loaded.length,
 				cameras: new Set(loaded.map((t) => t.candidate.deviceId)).size,
 				camerasDropped: selection.camerasDropped,
-				droppedNoMedia: Math.max(0, rule.maxTiles - loaded.length),
+				droppedNoMedia: tileLoad.droppedNoMedia,
+				droppedDuplicateFrame: tileLoad.droppedDuplicateFrame,
 				mosaicBytes: mosaic.bytes,
 				mosaicPublished: mosaic.ref !== null,
 				enqueued,
@@ -15826,14 +15896,20 @@ var NcSummaryProducer = class {
 	}
 	/** One blob per tile — the cheap question (index rows) always first.
 	*  Duplicate camera-seconds are skipped so tracker ID churn cannot paint
-	*  the same driveway eleven times; leftover ranked candidates refill. */
+	*  the same driveway eleven times; leftover ranked candidates refill.
+	*
+	*  It COUNTS what it drops, per reason, because only this loop knows: the
+	*  caller sees tiles and has no way to tell a track that had no picture from
+	*  a rule whose quota was simply larger than the night. */
 	async loadTiles(input) {
-		const out = [];
+		const tiles = [];
 		const seenFrames = /* @__PURE__ */ new Set();
 		const seenIds = /* @__PURE__ */ new Set();
+		let droppedNoMedia = 0;
+		let droppedDuplicateFrame = 0;
 		const queue = [...input.preferred, ...input.refill];
 		for (const candidate of queue) {
-			if (out.length >= input.maxTiles) break;
+			if (tiles.length >= input.maxTiles) break;
 			if (seenIds.has(candidate.trackId)) continue;
 			seenIds.add(candidate.trackId);
 			const tags = { deviceId: candidate.deviceId };
@@ -15841,19 +15917,22 @@ var NcSummaryProducer = class {
 				const rows = await this.deps.listMediaInfo(candidate.trackId);
 				const picked = pickSummaryMedia(rows, (candidate.firstSeen + candidate.lastSeen) / 2);
 				if (picked === null) {
-					this.deps.logger.debug("summary tile dropped: the track carries no clean media", {
+					droppedNoMedia += 1;
+					this.deps.logger.info("summary tile dropped: the track carries no clean media", {
 						tags,
 						meta: {
 							ruleId: input.rule.id,
 							trackId: candidate.trackId,
-							mediaRows: rows.length
+							mediaRows: rows.length,
+							mediaKinds: [...new Set(rows.map((row) => row.kind))].sort()
 						}
 					});
 					continue;
 				}
 				const frameKey = frameDedupeKey(candidate.deviceId, picked.timestamp);
 				if (seenFrames.has(frameKey)) {
-					this.deps.logger.debug("summary tile dropped: same frame as an earlier tile", {
+					droppedDuplicateFrame += 1;
+					this.deps.logger.info("summary tile dropped: same frame as an earlier tile", {
 						tags,
 						meta: {
 							ruleId: input.rule.id,
@@ -15865,22 +15944,25 @@ var NcSummaryProducer = class {
 				}
 				const jpeg = await this.deps.readMedia(picked.key);
 				if (jpeg === null || jpeg.byteLength === 0) {
-					this.deps.logger.debug("summary tile dropped: the media blob could not be read", {
+					droppedNoMedia += 1;
+					this.deps.logger.info("summary tile dropped: the media blob could not be read", {
 						tags,
 						meta: {
 							ruleId: input.rule.id,
 							trackId: candidate.trackId,
-							mediaKey: picked.key
+							mediaKey: picked.key,
+							mediaKind: picked.kind
 						}
 					});
 					continue;
 				}
 				seenFrames.add(frameKey);
-				out.push({
+				tiles.push({
 					candidate,
 					jpeg
 				});
 			} catch (err) {
+				droppedNoMedia += 1;
 				this.deps.logger.warn("summary tile dropped: reading its media threw", {
 					tags,
 					meta: {
@@ -15891,7 +15973,11 @@ var NcSummaryProducer = class {
 				});
 			}
 		}
-		return out;
+		return {
+			tiles,
+			droppedNoMedia,
+			droppedDuplicateFrame
+		};
 	}
 	/**
 	* Render the mosaic, file it where event media lives, and mint the public
@@ -21208,10 +21294,13 @@ var NotificationCenter = class NotificationCenter {
 				});
 				return { success: true };
 			},
-			listSnoozes: async ({ caller }) => ({ snoozes: [...this.snoozes.listVisibleTo(caller.userId, caller.isAdmin)] }),
-			createSnooze: async ({ snooze, caller }) => ({ snooze: await this.createSnooze(snooze, caller) }),
+			listSnoozes: async ({ caller }) => {
+				const who = requireCapCaller("listSnoozes", caller);
+				return { snoozes: [...this.snoozes.listVisibleTo(who.userId, who.isAdmin)] };
+			},
+			createSnooze: async ({ snooze, caller }) => ({ snooze: await this.createSnooze(snooze, requireCapCaller("createSnooze", caller)) }),
 			cancelSnooze: async ({ snoozeId, caller }) => {
-				await this.cancelSnooze(snoozeId, caller);
+				await this.cancelSnooze(snoozeId, requireCapCaller("cancelSnooze", caller));
 				return { success: true };
 			},
 			getAlarmConfig: async () => this.alarmConfig(),
@@ -26836,6 +26925,639 @@ function updateTrackAggregate(prev, match, opts) {
 	};
 }
 //#endregion
+//#region src/pipeline-analytics/store/face-sort.ts
+var DEFAULT_FACE_SORT = {
+	by: "timestamp",
+	direction: "desc"
+};
+/** Resolve a caller's partial request into a complete order. */
+function resolveFaceSort(input) {
+	return {
+		by: input?.sortBy ?? DEFAULT_FACE_SORT.by,
+		direction: input?.sortDirection ?? DEFAULT_FACE_SORT.direction
+	};
+}
+/**
+* True when the store's `timestamp`-indexed paging already emits rows in the
+* requested order, so a paged read may STOP as soon as `limit` rows have passed
+* the filter.
+*
+* False for `suggestionConfidence`: the most certain suggestion may be the
+* oldest row in the window, so an early stop would silently answer with the
+* newest N ranked — the exact defect this order was added to remove.
+*/
+function sortIsServedByTimestampPaging(order) {
+	return order.by === "timestamp";
+}
+/** Certainty, or `null` when the row has none. Null and undefined are the same
+*  answer — the relational backend surfaces an unset REAL column as SQL NULL. */
+function certaintyOf(face) {
+	return face.suggestedMatchScore ?? null;
+}
+/** Newest first, then `id` ascending. The tail of every comparison. */
+function compareTiebreak(a, b) {
+	if (a.timestamp !== b.timestamp) return b.timestamp - a.timestamp;
+	if (a.id === b.id) return 0;
+	return a.id < b.id ? -1 : 1;
+}
+function compareFaces(a, b, order) {
+	if (order.by === "timestamp") {
+		if (a.timestamp !== b.timestamp) return order.direction === "desc" ? b.timestamp - a.timestamp : a.timestamp - b.timestamp;
+		return compareTiebreak(a, b);
+	}
+	const aScore = certaintyOf(a);
+	const bScore = certaintyOf(b);
+	if (aScore === null && bScore !== null) return 1;
+	if (aScore !== null && bScore === null) return -1;
+	if (aScore !== null && bScore !== null && aScore !== bScore) return order.direction === "desc" ? bScore - aScore : aScore - bScore;
+	return compareTiebreak(a, b);
+}
+/** Immutable sort — the input array is never reordered in place. */
+function sortFaces(faces, order) {
+	return faces.toSorted((a, b) => compareFaces(a, b, order));
+}
+/**
+* Rank `faces` and keep at most `limit` of them.
+*
+* This is what lets the confidence order stay bounded: a paged sweep folds each
+* page in through here, so the retained set is the caller's `limit`, never the
+* corpus — even though the sweep itself has to walk the whole window.
+*/
+function rankAndCap(faces, order, limit) {
+	const sorted = sortFaces(faces, order);
+	return limit === void 0 ? sorted : sorted.slice(0, limit);
+}
+//#endregion
+//#region src/pipeline-analytics/store/face-store.ts
+/**
+* @durable class=ledger owner=pipeline-analytics
+*   write="one UPSERT per track that produced a face detail — the id is
+*     'face-<trackId>', so a track has at most one row and the recognizer
+*     overwrites it as a better read lands (embedding, match cosine, crop keys).
+*     The row is rewritten again when the operator enrols it, which flips
+*     `assigned` and stamps the identity."
+*   retention="TRACK-OWNED and clockless (D61): unassigned rows leave with their
+*     track through FaceStore.deleteByTracks, and enrolled (`assigned`) rows are
+*     exempt from that and from every sweep — an assignment is a curation act.
+*     The only other bound is capacity: pruneCapOverflow holds each camera's
+*     UNASSIGNED buffer to bufferMaxPerDevice newest rows (default 50). At 10.8 KB
+*     of JSON embedding per row, that cap is what keeps the table small."
+*/
+var FACES_COLLECTION = "pipeline-analytics:faces";
+/**
+* Rows per page for the two whole-collection sweeps below.
+*
+* A face row is one of the two WIDEST row shapes in the hub's database: it
+* carries a JSON `embedding` on every single row, measured at **10.8 KB
+* average** where a motion event is 78 bytes. Both sweeps used to read the
+* collection in ONE statement with no `limit`.
+*
+* To be exact about what that did and did not cause: this table holds **372
+* rows / 4.0 MB** on the live hub, so it was *not* the read that killed
+* hub-main on 2026-08-07 (that was the multi-camera track feed — see
+* `RECENT_FANOUT_ROW_BUDGET` in `track-store.ts`). It is a full scan whose cost
+* grows with a table nothing else bounds, which is the same defect one incident
+* earlier. `pruneCapOverflow` is what keeps the row count small — and it was
+* itself one of the two unbounded readers, so the bound and the thing enforcing
+* it were the same loop.
+*
+* The engine now refuses an unbounded read (`query-bounds.ts`), so paging here
+* is not belt-and-braces: without it these two methods would silently see only
+* the newest N rows and the buffer would grow forever.
+*
+* 1 000 keeps peak transfer around 11 MB while staying under the engine's own
+* cap, so the page is always the caller's bound and never the engine's.
+*/
+var FACE_SWEEP_PAGE = 1e3;
+/**
+* Refuses to loop forever if a page ever fails to advance. 1 000 pages is a
+* million faces — far past anything real, and reached only by a bug.
+*/
+var FACE_SWEEP_MAX_PAGES = 1e3;
+var FACE_COLUMNS = [
+	{
+		name: "id",
+		type: "TEXT",
+		primaryKey: true,
+		notNull: true
+	},
+	{
+		name: "deviceId",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "trackId",
+		type: "TEXT",
+		notNull: true
+	},
+	{
+		name: "timestamp",
+		type: "INTEGER",
+		notNull: true
+	},
+	{
+		name: "embedding",
+		type: "JSON",
+		notNull: true
+	},
+	{
+		name: "embeddingModelId",
+		type: "TEXT"
+	},
+	{
+		name: "mediaKey",
+		type: "TEXT"
+	},
+	{
+		name: "recognizedIdentityId",
+		type: "TEXT"
+	},
+	{
+		name: "assigned",
+		type: "BOOLEAN",
+		notNull: true
+	},
+	{
+		name: "assignedSampleId",
+		type: "TEXT"
+	},
+	{
+		name: "keyFrameMediaKey",
+		type: "TEXT"
+	},
+	{
+		name: "faceBbox",
+		type: "JSON"
+	},
+	{
+		name: "bestMatchScore",
+		type: "REAL"
+	},
+	{
+		name: "nativeFaceShortSidePx",
+		type: "REAL"
+	},
+	{
+		name: "suggestedIdentityId",
+		type: "TEXT"
+	},
+	{
+		name: "suggestedMatchScore",
+		type: "REAL"
+	}
+];
+var FACE_INDEXES = [{
+	name: "idx_faces_device_ts",
+	columns: ["deviceId", "timestamp"]
+}, {
+	name: "idx_faces_track",
+	columns: ["trackId"]
+}];
+/**
+* `since` / `until` as a store predicate.
+*
+* The filter surface has exactly one range form, `whereBetween`, and it is
+* inclusive on both ends — so a one-sided window is expressed by pinning the
+* other end to the edge of the safe integer range rather than by omitting it.
+* Returns `{}` when the caller named no window, so the read stays exactly the
+* unwindowed one.
+*/
+function buildTimestampWindow(input) {
+	if (input.since === void 0 && input.until === void 0) return {};
+	return { whereBetween: { timestamp: [input.since ?? Number.MIN_SAFE_INTEGER, input.until ?? Number.MAX_SAFE_INTEGER] } };
+}
+/**
+* One stored row → one {@link Face}.
+*
+* The single documented type boundary of this store: `SettingsRecord.data` is
+* `Record<string, unknown>` on the wire and the column set is declared right
+* here in {@link FACE_COLUMNS}, so this is the one place allowed to name the
+* shape it wrote.
+*
+* It also owns the NULL normalisation, and that is not cosmetic: the relational
+* backend surfaces an unset optional column as SQL NULL, and `FaceInfo`'s
+* optional strings REJECT null — an un-normalised row fails
+* `faceGallery.listRecentFaces` output validation and the People page renders
+* empty. This used to be copied out three times, which is three chances to
+* forget the next additive column.
+*/
+function rowToFace(id, raw) {
+	const data = raw;
+	return {
+		...data,
+		id,
+		assigned: Boolean(data.assigned),
+		mediaKey: data.mediaKey ?? void 0,
+		recognizedIdentityId: data.recognizedIdentityId ?? void 0,
+		assignedSampleId: data.assignedSampleId ?? void 0,
+		keyFrameMediaKey: data.keyFrameMediaKey ?? void 0,
+		faceBbox: data.faceBbox ?? void 0,
+		bestMatchScore: data.bestMatchScore ?? void 0,
+		nativeFaceShortSidePx: data.nativeFaceShortSidePx ?? void 0,
+		suggestedIdentityId: data.suggestedIdentityId ?? void 0,
+		suggestedMatchScore: data.suggestedMatchScore ?? void 0
+	};
+}
+var FaceStore = class {
+	store;
+	logger;
+	constructor(deps) {
+		this.store = deps.store;
+		this.logger = deps.logger;
+	}
+	static async declare(store) {
+		await store.declareCollection.mutate({
+			collection: FACES_COLLECTION,
+			columns: [...FACE_COLUMNS],
+			indexes: [...FACE_INDEXES]
+		});
+	}
+	/**
+	* Upsert one buffered face. Keyed by `face.id` (the worker uses one stable
+	* id per track → one entry per track). `set` replaces an existing row.
+	*/
+	async insert(face) {
+		const { id, ...rest } = face;
+		try {
+			await this.store.set.mutate({
+				collection: FACES_COLLECTION,
+				key: id,
+				value: rest
+			});
+		} catch (err) {
+			this.logger.warn("FaceStore.insert failed", {
+				tags: { deviceId: face.deviceId },
+				meta: {
+					faceId: id,
+					error: String(err)
+				}
+			});
+		}
+	}
+	/**
+	* Recent UNASSIGNED faces (the enrollment buffer), newest first.
+	*
+	* NOTE: `assigned` is normalized via `Boolean()` on read so the production
+	* SQLite backend (which returns INTEGER 0/1) is handled correctly.
+	*/
+	async listRecentFaces(input) {
+		const where = {};
+		if (input.deviceId !== void 0) where["deviceId"] = input.deviceId;
+		return (await this.store.query.query({
+			collection: FACES_COLLECTION,
+			filter: {
+				where,
+				orderBy: {
+					field: "timestamp",
+					direction: "desc"
+				},
+				limit: input.limit ?? 100
+			}
+		})).map((r) => rowToFace(r.id, r.data)).filter((f) => !f.assigned);
+	}
+	/**
+	* The per-device `prune(deviceId, cutoffMs, maxPerDevice)` that used to sit
+	* here is GONE (D61). It had no production caller — only tests — and it was
+	* an age-keyed deletion of a track-OWNED entity, i.e. the exact thing the
+	* retention model now forbids. A leftover that describes the wrong design
+	* still reads as permission to use it.
+	*/
+	/**
+	* Hold the unassigned face buffer to `maxPerDevice` newest rows per camera.
+	*
+	* **This is a CAPACITY bound, not an age one.** It used to be both: a face
+	* was deleted if it was older than `bufferRetentionDays` OR beyond the cap.
+	* The age half was a fifth clock over a track-OWNED entity — a face row
+	* carries a `trackId`, so it belongs to its track and cascades with it — and
+	* it aged crops out from under tracks that were still well inside their own
+	* retention window. It is gone (D61). What remains is the ring-buffer
+	* property the recognizer actually depends on: the gallery of recent
+	* unassigned faces stays small.
+	*
+	* ENROLLED (`assigned`) rows are skipped entirely and do not consume cap
+	* slots. Returns all deleted ids (the caller removes their crops).
+	*/
+	async pruneCapOverflow(input) {
+		/**
+		* Paged, not one statement. Only three scalars per row survive the page —
+		* the `embedding` string that dominates the row is dropped as soon as the
+		* page goes out of scope, so peak heap is one page rather than the whole
+		* face table. The prune still considers EVERY row, which is what makes it a
+		* capacity bound rather than a bound on the newest page.
+		*/
+		const byDevice = /* @__PURE__ */ new Map();
+		for (let page = 0; page < FACE_SWEEP_MAX_PAGES; page++) {
+			const rows = await this.store.query.query({
+				collection: FACES_COLLECTION,
+				filter: {
+					orderBy: {
+						field: "timestamp",
+						direction: "desc"
+					},
+					limit: FACE_SWEEP_PAGE,
+					offset: page * FACE_SWEEP_PAGE
+				}
+			});
+			if (rows.length === 0) break;
+			for (const r of rows) {
+				const data = r.data;
+				if (data.assigned) continue;
+				const deviceId = Number(data.deviceId ?? -1);
+				const list = byDevice.get(deviceId) ?? [];
+				list.push({
+					id: r.id,
+					timestamp: Number(data.timestamp ?? 0)
+				});
+				byDevice.set(deviceId, list);
+			}
+			if (rows.length < 1e3) break;
+		}
+		const toDelete = /* @__PURE__ */ new Set();
+		for (const list of byDevice.values()) {
+			list.sort((a, b) => b.timestamp - a.timestamp);
+			list.forEach((row, idx) => {
+				if (idx >= input.maxPerDevice) toDelete.add(row.id);
+			});
+		}
+		const deleted = [];
+		for (const id of toDelete) try {
+			await this.store.delete.mutate({
+				collection: FACES_COLLECTION,
+				key: id
+			});
+			deleted.push(id);
+		} catch (err) {
+			this.logger.warn("FaceStore.pruneCapOverflow delete failed", { meta: {
+				faceId: id,
+				error: String(err)
+			} });
+		}
+		return deleted;
+	}
+	/** Flip `assigned` to true and record which identity was matched. Optionally persist the sample id. */
+	async markAssigned(faceId, identityId, sampleId) {
+		const data = {
+			assigned: true,
+			recognizedIdentityId: identityId
+		};
+		if (sampleId !== void 0) data["assignedSampleId"] = sampleId;
+		try {
+			await this.store.update.mutate({
+				collection: FACES_COLLECTION,
+				id: faceId,
+				data
+			});
+		} catch (err) {
+			this.logger.warn("FaceStore.markAssigned failed", { meta: {
+				faceId,
+				error: String(err)
+			} });
+		}
+	}
+	/** Clear the assignment: set assigned=false, clear recognizedIdentityId and assignedSampleId. */
+	async clearAssignment(faceId) {
+		try {
+			await this.store.update.mutate({
+				collection: FACES_COLLECTION,
+				id: faceId,
+				data: {
+					assigned: false,
+					recognizedIdentityId: null,
+					assignedSampleId: null
+				}
+			});
+		} catch (err) {
+			this.logger.warn("FaceStore.clearAssignment failed", { meta: {
+				faceId,
+				error: String(err)
+			} });
+		}
+	}
+	/**
+	* Persist a `face.rescoreTrack` result onto the SUGGESTED tier — the ONE
+	* write that explicitly-requested action makes. `suggestion: null` means
+	* the recompute found no candidate worth offering and CLEARS both columns
+	* (a genuine "the gallery has nothing for this face right now" result, not
+	* a no-op left at whatever they held before). Never touches `assigned` /
+	* `recognizedIdentityId` — a suggestion is never an assignment. The caller
+	* is responsible for never calling this with a non-comparable (`model-
+	* mismatch`) report; this method persists whatever it is given.
+	*/
+	async setSuggestion(faceId, suggestion) {
+		const data = suggestion === null ? {
+			suggestedIdentityId: null,
+			suggestedMatchScore: null
+		} : {
+			suggestedIdentityId: suggestion.identityId,
+			suggestedMatchScore: suggestion.score
+		};
+		try {
+			await this.store.update.mutate({
+				collection: FACES_COLLECTION,
+				id: faceId,
+				data
+			});
+		} catch (err) {
+			this.logger.warn("FaceStore.setSuggestion failed", { meta: {
+				faceId,
+				error: String(err)
+			} });
+		}
+	}
+	/**
+	* `TrackScopedStore` contract for the retention cascade: delete the buffered
+	* face rows of the given tracks that are NOT assigned. Reuses the EXACT
+	* `assigned` exemption that `prune`/`pruneAll` apply (see the
+	* `!(r.data.assigned)` predicate above) so ENROLLED faces SURVIVE retention.
+	* Per-track ISOLATED + best-effort per row — one bad track or row never
+	* aborts the batch. (Crop media of these rows is removed by `MediaStore`.)
+	*/
+	async deleteByTracks(trackIds) {
+		let removed = 0;
+		for (const trackId of trackIds) try {
+			const eligible = (await this.store.query.query({
+				collection: FACES_COLLECTION,
+				filter: { where: { trackId } }
+			})).filter((r) => !r.data.assigned);
+			for (const row of eligible) try {
+				await this.store.delete.mutate({
+					collection: FACES_COLLECTION,
+					key: row.id
+				});
+				removed++;
+			} catch (err) {
+				this.logger.warn("FaceStore.deleteByTracks delete failed", { meta: {
+					faceId: row.id,
+					error: String(err)
+				} });
+			}
+		} catch (err) {
+			this.logger.warn("FaceStore.deleteByTracks query failed", { meta: {
+				trackId,
+				error: String(err)
+			} });
+		}
+		return [{
+			family: "faces",
+			rows: removed,
+			bytes: 0
+		}];
+	}
+	/** Delete a single buffered face row by id (its crop media is removed by the
+	*  caller — the FaceStore owns rows, not blobs). Best-effort. */
+	async delete(faceId) {
+		try {
+			await this.store.delete.mutate({
+				collection: FACES_COLLECTION,
+				key: faceId
+			});
+		} catch (err) {
+			this.logger.warn("FaceStore.delete failed", { meta: {
+				faceId,
+				error: String(err)
+			} });
+		}
+	}
+	/**
+	* Retrieve a single face by id. Returns null if not found.
+	*/
+	async get(faceId) {
+		const raw = await this.store.get.query({
+			collection: FACES_COLLECTION,
+			key: faceId
+		});
+		if (!raw) return null;
+		return rowToFace(faceId, raw);
+	}
+	/**
+	* Update internal fields of a face (used for partial mutation, e.g. setting recognizedIdentityId).
+	* Not exposed publicly — intended for internal use and tests only.
+	*/
+	async update(faceId, data) {
+		try {
+			await this.store.update.mutate({
+				collection: FACES_COLLECTION,
+				id: faceId,
+				data
+			});
+		} catch (err) {
+			this.logger.warn("FaceStore.update failed", { meta: {
+				faceId,
+				error: String(err)
+			} });
+		}
+	}
+	/**
+	* List recent faces across the cluster, or across a named set of cameras.
+	*
+	* filter:
+	*  - 'all' (default)        → every row
+	*  - 'unassigned'           → !assigned
+	*  - 'recognized'           → !assigned && recognizedIdentityId != null
+	*  - 'identified'           → recognizedIdentityId != null, including manual assignments
+	*
+	* `deviceIds`, `since` and `until` are pushed INTO the query — they narrow
+	* what is read, not what is returned. `filter` and the ordering cannot be
+	* (the first is a computed predicate, the second is a contract this backend
+	* does not implement — see `face-sort.ts`), so they are applied here.
+	*
+	* **`limit` counts rows that PASSED the filter, never rows that were
+	* discarded.** That is the whole reason this pages instead of asking the
+	* store for `limit` rows: with `filter:'unassigned'` the newest N rows may be
+	* entirely assigned while matches wait just beyond them.
+	*
+	* The previous answer was to fetch the WHOLE collection and slice after
+	* filtering. That is the read that killed hub-main (`query-bounds.ts`) —
+	* every face row carries a JSON `embedding`, so "all rows" is the widest
+	* table in the database materialised at once, to render a gallery of at most
+	* a few hundred tiles.
+	*
+	* So: PAGE. Under the default `timestamp` order the store's paging already
+	* emits rows in the answer's order, so the sweep stops the moment enough
+	* MATCHES exist and the common case costs one page. Under
+	* `suggestionConfidence` it cannot — the most certain suggestion may be the
+	* oldest row — so the sweep walks the window and folds each page through
+	* `rankAndCap`, which holds the RETAINED set to `limit` even though the read
+	* is wider. Narrow the read with `since` / `until`.
+	*
+	* An **empty `deviceIds` reads nothing at all**: `[]` is a request for no
+	* cameras, not an omission (the `deviceManager.listFleet` contract).
+	*/
+	async listAllRecentFaces(input) {
+		if (input.deviceIds !== void 0 && input.deviceIds.length === 0) return [];
+		const order = resolveFaceSort(input);
+		const pagingServesTheOrder = sortIsServedByTimestampPaging(order);
+		const filterMode = input.filter ?? "all";
+		const matches = (f) => {
+			if (filterMode === "unassigned") return !f.assigned;
+			if (filterMode === "recognized") return !f.assigned && f.recognizedIdentityId != null;
+			if (filterMode === "identified") return f.recognizedIdentityId != null;
+			return true;
+		};
+		const storeFilter = {
+			...input.deviceIds !== void 0 ? { whereIn: { deviceId: [...new Set(input.deviceIds)] } } : {},
+			...buildTimestampWindow(input),
+			orderBy: {
+				field: "timestamp",
+				direction: pagingServesTheOrder ? order.direction : "desc"
+			}
+		};
+		let result = [];
+		for (let page = 0; page < FACE_SWEEP_MAX_PAGES; page++) {
+			const rows = await this.store.query.query({
+				collection: FACES_COLLECTION,
+				filter: {
+					...storeFilter,
+					limit: FACE_SWEEP_PAGE,
+					offset: page * FACE_SWEEP_PAGE
+				}
+			});
+			if (rows.length === 0) break;
+			const matched = [];
+			for (const r of rows) {
+				const face = rowToFace(r.id, r.data);
+				if (matches(face)) matched.push(face);
+			}
+			if (pagingServesTheOrder) {
+				const merged = [...result, ...matched];
+				if (input.limit !== void 0 && merged.length >= input.limit) return merged.slice(0, input.limit);
+				result = merged;
+			} else result = rankAndCap([...result, ...matched], order, input.limit);
+			if (rows.length < 1e3) break;
+		}
+		return pagingServesTheOrder ? result : rankAndCap(result, order, input.limit);
+	}
+	/** One real face row per camera currently attributed to an identity. */
+	async listCameraRefsForIdentity(identityId) {
+		const byDevice = /* @__PURE__ */ new Map();
+		for (let page = 0; page < FACE_SWEEP_MAX_PAGES; page++) {
+			const rows = await this.store.query.query({
+				collection: FACES_COLLECTION,
+				filter: {
+					where: { recognizedIdentityId: identityId },
+					orderBy: {
+						field: "timestamp",
+						direction: "desc"
+					},
+					limit: FACE_SWEEP_PAGE,
+					offset: page * FACE_SWEEP_PAGE
+				}
+			});
+			if (rows.length === 0) break;
+			for (const row of rows) {
+				const deviceId = Number(row.data["deviceId"]);
+				if (Number.isInteger(deviceId) && !byDevice.has(deviceId)) byDevice.set(deviceId, row.id);
+			}
+			if (rows.length < 1e3) break;
+		}
+		return [...byDevice].map(([deviceId, faceId]) => ({
+			deviceId,
+			faceId
+		}));
+	}
+};
+//#endregion
 //#region src/pipeline-analytics/face-gallery-provider.ts
 /** Attribution of a face identity NAMED BY THE OPERATOR in the gallery. */
 var OPERATOR_FACE_STEP_ID = "operator:face-gallery";
@@ -26849,6 +27571,36 @@ var OPERATOR_FACE_STEP_ID = "operator:face-gallery";
 * stalled pipeline.
 */
 var FACE_CROP_FETCH_CONCURRENCY = 16;
+/**
+* How many unassigned faces `suggestFaceClusters` reads when the caller names
+* no {@link SuggestFaceClustersInput.maxFacesScanned}.
+*
+* Clustering used to read EVERY unassigned face on the hub, unconditionally:
+* its only bound (`limit`) cut the finished clusters, so it shortened the
+* ANSWER and never the work. A UI showing a window of 100 paid for a scan of
+* the whole corpus — on an addon whose disk is under contention — and no caller
+* had any way to ask for less.
+*
+* `FACE_SWEEP_PAGE` is chosen on purpose rather than a round number: it is
+* exactly ONE store page, so on the live corpus (372 face rows) the default
+* reads what it read before, one page, and nothing about today's answers
+* changes. What changes is the ceiling — the unbounded scan cannot come back as
+* the table grows.
+*/
+var SUGGEST_CLUSTERS_DEFAULT_FACE_POOL = FACE_SWEEP_PAGE;
+/**
+* The camera set a face listing is scoped to, as ONE value.
+*
+* `deviceIds` is the authority whenever it is present — including when it is
+* EMPTY, which reads nothing (a request for no cameras is a request, not an
+* omission). `deviceId` is the legacy single-camera form and only applies when
+* no set was named, so the two can never disagree about the answer.
+*/
+function resolveFaceDeviceScope(input) {
+	if (input?.deviceIds !== void 0) return { deviceIds: input.deviceIds };
+	if (input?.deviceId !== void 0) return { deviceIds: [input.deviceId] };
+	return {};
+}
 var FaceGalleryProvider = class {
 	identityStore;
 	faceStore;
@@ -26984,9 +27736,13 @@ var FaceGalleryProvider = class {
 	}
 	async listRecentFaces(input) {
 		const faces = await this.faceStore.listAllRecentFaces({
-			deviceId: input?.deviceId,
+			...resolveFaceDeviceScope(input),
 			limit: input?.limit,
-			filter: input?.filter
+			filter: input?.filter,
+			since: input?.since,
+			until: input?.until,
+			sortBy: input?.sortBy,
+			sortDirection: input?.sortDirection
 		});
 		const identities = await this.identityStore.listIdentities();
 		const nameMap = new Map(identities.map((i) => [i.id, i.name]));
@@ -27242,16 +27998,34 @@ var FaceGalleryProvider = class {
 	* Suggest clusters of look-alike UNASSIGNED faces (greedy cosine on their
 	* embeddings) so the operator can batch-assign a whole group. Embeddings stay
 	* server-side; only faceId groupings are returned.
+	*
+	* TWO bounds, and they cut different things — which is the whole point of the
+	* rename:
+	*  - `maxFacesScanned` bounds the POOL, i.e. the work. Newest unassigned
+	*    faces first, default {@link SUGGEST_CLUSTERS_DEFAULT_FACE_POOL}.
+	*  - `maxClusters` (formerly the ambiguous `limit`) bounds the ANSWER.
+	*    It has never made this method read one row less.
 	*/
 	async suggestFaceClusters(input) {
 		const threshold = input?.threshold ?? .5;
 		const minClusterSize = input?.minClusterSize ?? 2;
-		let clusters = clusterByEmbedding((await this.faceStore.listAllRecentFaces({ filter: "unassigned" })).filter((f) => Array.isArray(f.embedding) && f.embedding.length > 0).map((f) => ({
+		const maxFacesScanned = input?.maxFacesScanned ?? SUGGEST_CLUSTERS_DEFAULT_FACE_POOL;
+		const maxClusters = input?.maxClusters ?? input?.limit;
+		const faces = await this.faceStore.listAllRecentFaces({
+			filter: "unassigned",
+			limit: maxFacesScanned
+		});
+		if (faces.length >= maxFacesScanned) this.logger.info("suggestFaceClusters pool saturated — older faces not considered", { meta: {
+			maxFacesScanned,
+			scanned: faces.length,
+			threshold,
+			minClusterSize
+		} });
+		const clusters = clusterByEmbedding(faces.filter((f) => Array.isArray(f.embedding) && f.embedding.length > 0).map((f) => ({
 			id: f.id,
 			embedding: f.embedding
 		})), threshold).filter((c) => c.size >= minClusterSize);
-		if (input?.limit !== void 0) clusters = clusters.slice(0, input.limit);
-		return clusters;
+		return maxClusters === void 0 ? clusters : clusters.slice(0, maxClusters);
 	}
 };
 //#endregion
@@ -40606,12 +41380,14 @@ function digestMediaRows(input) {
 	if (input.mediaKey !== null && input.mediaKey.length > 0) owned.push({
 		key: input.mediaKey,
 		kind: "groupCrop",
-		timestamp: input.timestamp
+		timestamp: input.timestamp,
+		sizeBytes: null
 	});
 	if (input.nativeKey !== null && input.nativeKey.length > 0) owned.push({
 		key: input.nativeKey,
 		kind: "nativeFrame",
-		timestamp: input.timestamp
+		timestamp: input.timestamp,
+		sizeBytes: null
 	});
 	if (owned.length > 0) return owned;
 	return input.memberRows.filter((row) => DIGEST_MEMBER_FALLBACK_KINDS.has(row.kind));
@@ -47496,553 +48272,6 @@ function stripNulls$1(data) {
 	return out;
 }
 //#endregion
-//#region src/pipeline-analytics/store/face-store.ts
-/**
-* @durable class=ledger owner=pipeline-analytics
-*   write="one UPSERT per track that produced a face detail — the id is
-*     'face-<trackId>', so a track has at most one row and the recognizer
-*     overwrites it as a better read lands (embedding, match cosine, crop keys).
-*     The row is rewritten again when the operator enrols it, which flips
-*     `assigned` and stamps the identity."
-*   retention="TRACK-OWNED and clockless (D61): unassigned rows leave with their
-*     track through FaceStore.deleteByTracks, and enrolled (`assigned`) rows are
-*     exempt from that and from every sweep — an assignment is a curation act.
-*     The only other bound is capacity: pruneCapOverflow holds each camera's
-*     UNASSIGNED buffer to bufferMaxPerDevice newest rows (default 50). At 10.8 KB
-*     of JSON embedding per row, that cap is what keeps the table small."
-*/
-var FACES_COLLECTION = "pipeline-analytics:faces";
-/**
-* Rows per page for the two whole-collection sweeps below.
-*
-* A face row is one of the two WIDEST row shapes in the hub's database: it
-* carries a JSON `embedding` on every single row, measured at **10.8 KB
-* average** where a motion event is 78 bytes. Both sweeps used to read the
-* collection in ONE statement with no `limit`.
-*
-* To be exact about what that did and did not cause: this table holds **372
-* rows / 4.0 MB** on the live hub, so it was *not* the read that killed
-* hub-main on 2026-08-07 (that was the multi-camera track feed — see
-* `RECENT_FANOUT_ROW_BUDGET` in `track-store.ts`). It is a full scan whose cost
-* grows with a table nothing else bounds, which is the same defect one incident
-* earlier. `pruneCapOverflow` is what keeps the row count small — and it was
-* itself one of the two unbounded readers, so the bound and the thing enforcing
-* it were the same loop.
-*
-* The engine now refuses an unbounded read (`query-bounds.ts`), so paging here
-* is not belt-and-braces: without it these two methods would silently see only
-* the newest N rows and the buffer would grow forever.
-*
-* 1 000 keeps peak transfer around 11 MB while staying under the engine's own
-* cap, so the page is always the caller's bound and never the engine's.
-*/
-var FACE_SWEEP_PAGE = 1e3;
-/**
-* Refuses to loop forever if a page ever fails to advance. 1 000 pages is a
-* million faces — far past anything real, and reached only by a bug.
-*/
-var FACE_SWEEP_MAX_PAGES = 1e3;
-var FACE_COLUMNS = [
-	{
-		name: "id",
-		type: "TEXT",
-		primaryKey: true,
-		notNull: true
-	},
-	{
-		name: "deviceId",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "trackId",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		name: "timestamp",
-		type: "INTEGER",
-		notNull: true
-	},
-	{
-		name: "embedding",
-		type: "JSON",
-		notNull: true
-	},
-	{
-		name: "embeddingModelId",
-		type: "TEXT"
-	},
-	{
-		name: "mediaKey",
-		type: "TEXT"
-	},
-	{
-		name: "recognizedIdentityId",
-		type: "TEXT"
-	},
-	{
-		name: "assigned",
-		type: "BOOLEAN",
-		notNull: true
-	},
-	{
-		name: "assignedSampleId",
-		type: "TEXT"
-	},
-	{
-		name: "keyFrameMediaKey",
-		type: "TEXT"
-	},
-	{
-		name: "faceBbox",
-		type: "JSON"
-	},
-	{
-		name: "bestMatchScore",
-		type: "REAL"
-	},
-	{
-		name: "nativeFaceShortSidePx",
-		type: "REAL"
-	},
-	{
-		name: "suggestedIdentityId",
-		type: "TEXT"
-	},
-	{
-		name: "suggestedMatchScore",
-		type: "REAL"
-	}
-];
-var FACE_INDEXES = [{
-	name: "idx_faces_device_ts",
-	columns: ["deviceId", "timestamp"]
-}, {
-	name: "idx_faces_track",
-	columns: ["trackId"]
-}];
-var FaceStore = class {
-	store;
-	logger;
-	constructor(deps) {
-		this.store = deps.store;
-		this.logger = deps.logger;
-	}
-	static async declare(store) {
-		await store.declareCollection.mutate({
-			collection: FACES_COLLECTION,
-			columns: [...FACE_COLUMNS],
-			indexes: [...FACE_INDEXES]
-		});
-	}
-	/**
-	* Upsert one buffered face. Keyed by `face.id` (the worker uses one stable
-	* id per track → one entry per track). `set` replaces an existing row.
-	*/
-	async insert(face) {
-		const { id, ...rest } = face;
-		try {
-			await this.store.set.mutate({
-				collection: FACES_COLLECTION,
-				key: id,
-				value: rest
-			});
-		} catch (err) {
-			this.logger.warn("FaceStore.insert failed", {
-				tags: { deviceId: face.deviceId },
-				meta: {
-					faceId: id,
-					error: String(err)
-				}
-			});
-		}
-	}
-	/**
-	* Recent UNASSIGNED faces (the enrollment buffer), newest first.
-	*
-	* NOTE: `assigned` is normalized via `Boolean()` on read so the production
-	* SQLite backend (which returns INTEGER 0/1) is handled correctly.
-	*/
-	async listRecentFaces(input) {
-		const where = {};
-		if (input.deviceId !== void 0) where["deviceId"] = input.deviceId;
-		return (await this.store.query.query({
-			collection: FACES_COLLECTION,
-			filter: {
-				where,
-				orderBy: {
-					field: "timestamp",
-					direction: "desc"
-				},
-				limit: input.limit ?? 100
-			}
-		})).map((r) => {
-			const data = r.data;
-			return {
-				id: r.id,
-				...data,
-				assigned: Boolean(r.data.assigned),
-				mediaKey: data.mediaKey ?? void 0,
-				recognizedIdentityId: data.recognizedIdentityId ?? void 0,
-				assignedSampleId: data.assignedSampleId ?? void 0,
-				keyFrameMediaKey: data.keyFrameMediaKey ?? void 0,
-				faceBbox: data.faceBbox ?? void 0,
-				bestMatchScore: data.bestMatchScore ?? void 0,
-				nativeFaceShortSidePx: data.nativeFaceShortSidePx ?? void 0,
-				suggestedIdentityId: data.suggestedIdentityId ?? void 0,
-				suggestedMatchScore: data.suggestedMatchScore ?? void 0
-			};
-		}).filter((f) => !f.assigned);
-	}
-	/**
-	* The per-device `prune(deviceId, cutoffMs, maxPerDevice)` that used to sit
-	* here is GONE (D61). It had no production caller — only tests — and it was
-	* an age-keyed deletion of a track-OWNED entity, i.e. the exact thing the
-	* retention model now forbids. A leftover that describes the wrong design
-	* still reads as permission to use it.
-	*/
-	/**
-	* Hold the unassigned face buffer to `maxPerDevice` newest rows per camera.
-	*
-	* **This is a CAPACITY bound, not an age one.** It used to be both: a face
-	* was deleted if it was older than `bufferRetentionDays` OR beyond the cap.
-	* The age half was a fifth clock over a track-OWNED entity — a face row
-	* carries a `trackId`, so it belongs to its track and cascades with it — and
-	* it aged crops out from under tracks that were still well inside their own
-	* retention window. It is gone (D61). What remains is the ring-buffer
-	* property the recognizer actually depends on: the gallery of recent
-	* unassigned faces stays small.
-	*
-	* ENROLLED (`assigned`) rows are skipped entirely and do not consume cap
-	* slots. Returns all deleted ids (the caller removes their crops).
-	*/
-	async pruneCapOverflow(input) {
-		/**
-		* Paged, not one statement. Only three scalars per row survive the page —
-		* the `embedding` string that dominates the row is dropped as soon as the
-		* page goes out of scope, so peak heap is one page rather than the whole
-		* face table. The prune still considers EVERY row, which is what makes it a
-		* capacity bound rather than a bound on the newest page.
-		*/
-		const byDevice = /* @__PURE__ */ new Map();
-		for (let page = 0; page < FACE_SWEEP_MAX_PAGES; page++) {
-			const rows = await this.store.query.query({
-				collection: FACES_COLLECTION,
-				filter: {
-					orderBy: {
-						field: "timestamp",
-						direction: "desc"
-					},
-					limit: FACE_SWEEP_PAGE,
-					offset: page * FACE_SWEEP_PAGE
-				}
-			});
-			if (rows.length === 0) break;
-			for (const r of rows) {
-				const data = r.data;
-				if (data.assigned) continue;
-				const deviceId = Number(data.deviceId ?? -1);
-				const list = byDevice.get(deviceId) ?? [];
-				list.push({
-					id: r.id,
-					timestamp: Number(data.timestamp ?? 0)
-				});
-				byDevice.set(deviceId, list);
-			}
-			if (rows.length < 1e3) break;
-		}
-		const toDelete = /* @__PURE__ */ new Set();
-		for (const list of byDevice.values()) {
-			list.sort((a, b) => b.timestamp - a.timestamp);
-			list.forEach((row, idx) => {
-				if (idx >= input.maxPerDevice) toDelete.add(row.id);
-			});
-		}
-		const deleted = [];
-		for (const id of toDelete) try {
-			await this.store.delete.mutate({
-				collection: FACES_COLLECTION,
-				key: id
-			});
-			deleted.push(id);
-		} catch (err) {
-			this.logger.warn("FaceStore.pruneCapOverflow delete failed", { meta: {
-				faceId: id,
-				error: String(err)
-			} });
-		}
-		return deleted;
-	}
-	/** Flip `assigned` to true and record which identity was matched. Optionally persist the sample id. */
-	async markAssigned(faceId, identityId, sampleId) {
-		const data = {
-			assigned: true,
-			recognizedIdentityId: identityId
-		};
-		if (sampleId !== void 0) data["assignedSampleId"] = sampleId;
-		try {
-			await this.store.update.mutate({
-				collection: FACES_COLLECTION,
-				id: faceId,
-				data
-			});
-		} catch (err) {
-			this.logger.warn("FaceStore.markAssigned failed", { meta: {
-				faceId,
-				error: String(err)
-			} });
-		}
-	}
-	/** Clear the assignment: set assigned=false, clear recognizedIdentityId and assignedSampleId. */
-	async clearAssignment(faceId) {
-		try {
-			await this.store.update.mutate({
-				collection: FACES_COLLECTION,
-				id: faceId,
-				data: {
-					assigned: false,
-					recognizedIdentityId: null,
-					assignedSampleId: null
-				}
-			});
-		} catch (err) {
-			this.logger.warn("FaceStore.clearAssignment failed", { meta: {
-				faceId,
-				error: String(err)
-			} });
-		}
-	}
-	/**
-	* Persist a `face.rescoreTrack` result onto the SUGGESTED tier — the ONE
-	* write that explicitly-requested action makes. `suggestion: null` means
-	* the recompute found no candidate worth offering and CLEARS both columns
-	* (a genuine "the gallery has nothing for this face right now" result, not
-	* a no-op left at whatever they held before). Never touches `assigned` /
-	* `recognizedIdentityId` — a suggestion is never an assignment. The caller
-	* is responsible for never calling this with a non-comparable (`model-
-	* mismatch`) report; this method persists whatever it is given.
-	*/
-	async setSuggestion(faceId, suggestion) {
-		const data = suggestion === null ? {
-			suggestedIdentityId: null,
-			suggestedMatchScore: null
-		} : {
-			suggestedIdentityId: suggestion.identityId,
-			suggestedMatchScore: suggestion.score
-		};
-		try {
-			await this.store.update.mutate({
-				collection: FACES_COLLECTION,
-				id: faceId,
-				data
-			});
-		} catch (err) {
-			this.logger.warn("FaceStore.setSuggestion failed", { meta: {
-				faceId,
-				error: String(err)
-			} });
-		}
-	}
-	/**
-	* `TrackScopedStore` contract for the retention cascade: delete the buffered
-	* face rows of the given tracks that are NOT assigned. Reuses the EXACT
-	* `assigned` exemption that `prune`/`pruneAll` apply (see the
-	* `!(r.data.assigned)` predicate above) so ENROLLED faces SURVIVE retention.
-	* Per-track ISOLATED + best-effort per row — one bad track or row never
-	* aborts the batch. (Crop media of these rows is removed by `MediaStore`.)
-	*/
-	async deleteByTracks(trackIds) {
-		let removed = 0;
-		for (const trackId of trackIds) try {
-			const eligible = (await this.store.query.query({
-				collection: FACES_COLLECTION,
-				filter: { where: { trackId } }
-			})).filter((r) => !r.data.assigned);
-			for (const row of eligible) try {
-				await this.store.delete.mutate({
-					collection: FACES_COLLECTION,
-					key: row.id
-				});
-				removed++;
-			} catch (err) {
-				this.logger.warn("FaceStore.deleteByTracks delete failed", { meta: {
-					faceId: row.id,
-					error: String(err)
-				} });
-			}
-		} catch (err) {
-			this.logger.warn("FaceStore.deleteByTracks query failed", { meta: {
-				trackId,
-				error: String(err)
-			} });
-		}
-		return [{
-			family: "faces",
-			rows: removed,
-			bytes: 0
-		}];
-	}
-	/** Delete a single buffered face row by id (its crop media is removed by the
-	*  caller — the FaceStore owns rows, not blobs). Best-effort. */
-	async delete(faceId) {
-		try {
-			await this.store.delete.mutate({
-				collection: FACES_COLLECTION,
-				key: faceId
-			});
-		} catch (err) {
-			this.logger.warn("FaceStore.delete failed", { meta: {
-				faceId,
-				error: String(err)
-			} });
-		}
-	}
-	/**
-	* Retrieve a single face by id. Returns null if not found.
-	*/
-	async get(faceId) {
-		const raw = await this.store.get.query({
-			collection: FACES_COLLECTION,
-			key: faceId
-		});
-		if (!raw) return null;
-		const data = raw;
-		return {
-			id: faceId,
-			...data,
-			assigned: Boolean(raw.assigned),
-			mediaKey: data.mediaKey ?? void 0,
-			recognizedIdentityId: data.recognizedIdentityId ?? void 0,
-			assignedSampleId: data.assignedSampleId ?? void 0,
-			keyFrameMediaKey: data.keyFrameMediaKey ?? void 0,
-			faceBbox: data.faceBbox ?? void 0,
-			bestMatchScore: data.bestMatchScore ?? void 0,
-			nativeFaceShortSidePx: data.nativeFaceShortSidePx ?? void 0,
-			suggestedIdentityId: data.suggestedIdentityId ?? void 0,
-			suggestedMatchScore: data.suggestedMatchScore ?? void 0
-		};
-	}
-	/**
-	* Update internal fields of a face (used for partial mutation, e.g. setting recognizedIdentityId).
-	* Not exposed publicly — intended for internal use and tests only.
-	*/
-	async update(faceId, data) {
-		try {
-			await this.store.update.mutate({
-				collection: FACES_COLLECTION,
-				id: faceId,
-				data
-			});
-		} catch (err) {
-			this.logger.warn("FaceStore.update failed", { meta: {
-				faceId,
-				error: String(err)
-			} });
-		}
-	}
-	/**
-	* List ALL recent faces across all devices, newest-first.
-	*
-	* filter:
-	*  - 'all' (default)        → every row
-	*  - 'unassigned'           → !assigned
-	*  - 'recognized'           → !assigned && recognizedIdentityId != null
-	*  - 'identified'           → recognizedIdentityId != null, including manual assignments
-	*/
-	async listAllRecentFaces(input) {
-		/**
-		* The filter is applied in memory, so a DB `limit` of N cannot be the
-		* caller's N: with `filter:'unassigned'` the newest N rows may be entirely
-		* assigned while matches wait just beyond them.
-		*
-		* The previous answer was to fetch the WHOLE collection and slice after
-		* filtering. That is the read that killed hub-main (`query-bounds.ts`) —
-		* every face row carries a JSON `embedding`, so "all rows" is the widest
-		* table in the database materialised at once, to render a gallery of at
-		* most a few hundred tiles.
-		*
-		* PAGE instead, and stop as soon as enough MATCHES exist. The pathological
-		* case (a filter that matches nothing) walks the whole collection exactly
-		* as before but one bounded page at a time; the common case stops after the
-		* first page. Semantics are unchanged: the limit is still applied after the
-		* filter, never before it.
-		*/
-		const filterMode = input.filter ?? "all";
-		const matches = (f) => {
-			if (filterMode === "unassigned") return !f.assigned;
-			if (filterMode === "recognized") return !f.assigned && f.recognizedIdentityId != null;
-			if (filterMode === "identified") return f.recognizedIdentityId != null;
-			return true;
-		};
-		const result = [];
-		for (let page = 0; page < FACE_SWEEP_MAX_PAGES; page++) {
-			const rows = await this.store.query.query({
-				collection: FACES_COLLECTION,
-				filter: {
-					...input.deviceId !== void 0 ? { where: { deviceId: input.deviceId } } : {},
-					orderBy: {
-						field: "timestamp",
-						direction: "desc"
-					},
-					limit: FACE_SWEEP_PAGE,
-					offset: page * FACE_SWEEP_PAGE
-				}
-			});
-			if (rows.length === 0) break;
-			for (const r of rows) {
-				const data = r.data;
-				const face = {
-					id: r.id,
-					...data,
-					assigned: Boolean(r.data.assigned),
-					mediaKey: data.mediaKey ?? void 0,
-					recognizedIdentityId: data.recognizedIdentityId ?? void 0,
-					assignedSampleId: data.assignedSampleId ?? void 0,
-					keyFrameMediaKey: data.keyFrameMediaKey ?? void 0,
-					faceBbox: data.faceBbox ?? void 0,
-					bestMatchScore: data.bestMatchScore ?? void 0,
-					nativeFaceShortSidePx: data.nativeFaceShortSidePx ?? void 0,
-					suggestedIdentityId: data.suggestedIdentityId ?? void 0,
-					suggestedMatchScore: data.suggestedMatchScore ?? void 0
-				};
-				if (matches(face)) result.push(face);
-				if (input.limit !== void 0 && result.length >= input.limit) return result;
-			}
-			if (rows.length < 1e3) break;
-		}
-		return result;
-	}
-	/** One real face row per camera currently attributed to an identity. */
-	async listCameraRefsForIdentity(identityId) {
-		const byDevice = /* @__PURE__ */ new Map();
-		for (let page = 0; page < FACE_SWEEP_MAX_PAGES; page++) {
-			const rows = await this.store.query.query({
-				collection: FACES_COLLECTION,
-				filter: {
-					where: { recognizedIdentityId: identityId },
-					orderBy: {
-						field: "timestamp",
-						direction: "desc"
-					},
-					limit: FACE_SWEEP_PAGE,
-					offset: page * FACE_SWEEP_PAGE
-				}
-			});
-			if (rows.length === 0) break;
-			for (const row of rows) {
-				const deviceId = Number(row.data["deviceId"]);
-				if (Number.isInteger(deviceId) && !byDevice.has(deviceId)) byDevice.set(deviceId, row.id);
-			}
-			if (rows.length < 1e3) break;
-		}
-		return [...byDevice].map(([deviceId, faceId]) => ({
-			deviceId,
-			faceId
-		}));
-	}
-};
-//#endregion
 //#region src/pipeline-analytics/store/identity-store.ts
 /**
 * IdentityStore — per-person identity registry for face recognition.
@@ -60421,7 +60650,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 					const memberRows = (await Promise.all(members.map((m) => stores.mediaStore.listInfoByOwner("track", m.trackId)))).flatMap((rows) => rows.map((r) => ({
 						key: r.key,
 						kind: r.kind,
-						timestamp: r.timestamp
+						timestamp: r.timestamp,
+						sizeBytes: r.sizeBytes
 					})));
 					return digestMediaRows({
 						mediaKey: group.mediaKey,
@@ -60433,7 +60663,8 @@ var PipelineAnalyticsAddon = class PipelineAnalyticsAddon extends require_dist.B
 				return (await stores.mediaStore.listInfoByOwner("track", id)).map((r) => ({
 					key: r.key,
 					kind: r.kind,
-					timestamp: r.timestamp
+					timestamp: r.timestamp,
+					sizeBytes: r.sizeBytes
 				}));
 			},
 			readMedia: async (key) => {